program: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=@ipmr_delroute={0x34, 0x19, 0x200, 0x70bd28, 0x25dfdbfc, {0x80, 0x10, 0x94, 0xf7, 0xff, 0x0, 0xfe, 0x3, 0x1400}, [@RTA_FLOW={0x8, 0xb, 0x7}, @RTA_SPORT={0x6, 0x1c, 0x4e23}, @RTA_IP_PROTO={0x5, 0x1b, 0x6}]}, 0x34}}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) fallocate(r2, 0x0, 0x0, 0x10fff9) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x7000001, 0x12, r2, 0x4000) setsockopt$netrom_NETROM_IDLE(r2, 0x103, 0x7, &(0x7f0000000080)=0xff, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = openat$cgroup(r2, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r5, &(0x7f0000000180)='freezer.parent_freezing\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104}, [@IFLA_IFNAME={0x14, 0x3, 'ip6gre0\x00'}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=@ipmr_delroute={0x34, 0x19, 0x200, 0x70bd28, 0x25dfdbfc, {0x80, 0x10, 0x94, 0xf7, 0xff, 0x0, 0xfe, 0x3, 0x1400}, [@RTA_FLOW={0x8, 0xb, 0x7}, @RTA_SPORT={0x6, 0x1c, 0x4e23}, @RTA_IP_PROTO={0x5, 0x1b, 0x6}]}, 0x34}}, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) (async) fallocate(r2, 0x0, 0x0, 0x10fff9) (async) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x7000001, 0x12, r2, 0x4000) (async) setsockopt$netrom_NETROM_IDLE(r2, 0x103, 0x7, &(0x7f0000000080)=0xff, 0x4) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) openat$cgroup(r2, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) (async) openat$cgroup_ro(r5, &(0x7f0000000180)='freezer.parent_freezing\x00', 0x0, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000000)) (async) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104}, [@IFLA_IFNAME={0x14, 0x3, 'ip6gre0\x00'}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x3c}}, 0x0) (async) [ 85.098623][ T4686] Bluetooth: hci0: command tx timeout [ 85.262443][ T5342] bridge_slave_0: left allmulticast mode [ 85.270064][ T5342] bridge_slave_0: left promiscuous mode [ 85.272964][ T5342] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.282638][ T5342] bridge_slave_1: left allmulticast mode [ 85.285163][ T5342] bridge_slave_1: left promiscuous mode [ 85.291373][ T5342] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.300275][ T5342] bond0: (slave bond_slave_0): Releasing backup interface [ 85.307499][ T5342] bond0: (slave bond_slave_1): Releasing backup interface [ 85.320011][ T5342] team0: Port device team_slave_0 removed [ 85.325573][ T5342] team0: Port device team_slave_1 removed [ 85.330140][ T5342] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 85.333504][ T5342] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 85.339568][ T5342] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 85.342673][ T5342] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 85.348401][ T5342] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 85.362612][ T5343] ip6gre0: entered promiscuous mode [ 85.390577][ T5343] team0: Port device ip6gre0 added [ 85.407549][ T5349] team0: Port device ip6gre0 removed [ 85.416557][ T794] skbuff: skb_under_panic: text:ffffffff8a1ec838 len:136 put:40 head:ffff888033a99000 data:ffff888033a98fe8 tail:0x70 end:0x6c0 dev:team0 [ 85.427285][ T794] ------------[ cut here ]------------ [ 85.429696][ T794] kernel BUG at net/core/skbuff.c:213! [ 85.432052][ T794] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 85.434953][ T794] CPU: 0 UID: 0 PID: 794 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 85.439116][ T794] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 85.443676][ T794] Workqueue: mld mld_ifc_work [ 85.445802][ T794] RIP: 0010:skb_panic+0x157/0x160 [ 85.448174][ T794] Code: c7 e0 2e 6f 8c 48 8b 74 24 08 48 8b 54 24 10 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 55 41 57 41 56 e8 be 92 f5 ff 48 83 c4 20 90 <0f> 0b cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 85.456584][ T794] RSP: 0018:ffffc90001a2f280 EFLAGS: 00010282 [ 85.459212][ T794] RAX: 0000000000000087 RBX: dffffc0000000000 RCX: 8b7e09fa11a6a800 [ 85.462839][ T794] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 85.466431][ T794] RBP: 00000000000006c0 R08: ffffc90001a2ef87 R09: 1ffff92000345df0 [ 85.469865][ T794] R10: dffffc0000000000 R11: fffff52000345df1 R12: ffff88801c189290 [ 85.473164][ T794] R13: ffff888033a99000 R14: ffff888033a98fe8 R15: 0000000000000070 [ 85.476645][ T794] FS: 0000000000000000(0000) GS:ffff88808d679000(0000) knlGS:0000000000000000 [ 85.480451][ T794] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.483227][ T794] CR2: 00007ffe282cbe40 CR3: 000000000dd3a000 CR4: 0000000000352ef0 [ 85.486675][ T794] Call Trace: [ 85.488147][ T794] [ 85.489399][ T794] ? ip6gre_header+0xc8/0x790 [ 85.491317][ T794] ? ip6gre_header+0xc8/0x790 [ 85.493178][ T794] skb_push+0xc3/0xe0 [ 85.494859][ T794] ip6gre_header+0xc8/0x790 [ 85.496659][ T794] ? __pfx_ip6gre_header+0x10/0x10 [ 85.498642][ T794] ? read_seqbegin+0x1ac/0x250 [ 85.500657][ T794] ? __pfx_read_seqbegin+0x10/0x10 [ 85.502798][ T794] ? ___neigh_create+0x1c5f/0x2230 [ 85.504924][ T794] ? __pfx_ip6gre_header+0x10/0x10 [ 85.507113][ T794] neigh_connected_output+0x286/0x460 [ 85.509330][ T794] ip6_finish_output2+0xfb3/0x1480 [ 85.511464][ T794] ? __pfx_ip6_finish_output2+0x10/0x10 [ 85.513549][ T794] ? ip6_mtu+0x7d/0x490 [ 85.515327][ T794] ? ip6_mtu+0x7d/0x490 [ 85.517097][ T794] ip6_finish_output+0x234/0x7d0 [ 85.519293][ T794] ? ip6_output+0x126/0x550 [ 85.521275][ T794] ip6_output+0x340/0x550 [ 85.523201][ T794] NF_HOOK+0x9e/0x380 [ 85.524958][ T794] ? NF_HOOK+0x101/0x380 [ 85.526842][ T794] ? __pfx_NF_HOOK+0x10/0x10 [ 85.528916][ T794] ? __pfx_dst_output+0x10/0x10 [ 85.531089][ T794] ? icmp6_dst_alloc+0x3a5/0x420 [ 85.533270][ T794] ? icmp6_dst_alloc+0x3a5/0x420 [ 85.535565][ T794] mld_sendpack+0x8d4/0xe60 [ 85.537523][ T794] ? mld_sendpack+0x1e7/0xe60 [ 85.539504][ T794] ? __pfx_mld_sendpack+0x10/0x10 [ 85.541392][ T794] mld_ifc_work+0x83e/0xd60 [ 85.543308][ T794] ? _raw_spin_unlock_irq+0x23/0x50 [ 85.546646][ T794] ? process_scheduled_works+0x9ef/0x1770 [ 85.548964][ T794] process_scheduled_works+0xad1/0x1770 [ 85.551303][ T794] ? __pfx_process_scheduled_works+0x10/0x10 [ 85.554057][ T794] worker_thread+0x8a0/0xda0 [ 85.556034][ T794] kthread+0x711/0x8a0 [ 85.557824][ T794] ? __pfx_worker_thread+0x10/0x10 [ 85.560145][ T794] ? __pfx_kthread+0x10/0x10 [ 85.562121][ T794] ? _raw_spin_unlock_irq+0x23/0x50 [ 85.564397][ T794] ? lockdep_hardirqs_on+0x98/0x140 [ 85.566400][ T794] ? __pfx_kthread+0x10/0x10 [ 85.568272][ T794] ret_from_fork+0x599/0xb30 [ 85.570221][ T794] ? __pfx_ret_from_fork+0x10/0x10 [ 85.572005][ T794] ? __pfx_kthread+0x10/0x10 [ 85.573708][ T794] ret_from_fork_asm+0x1a/0x30 [ 85.575515][ T794] [ 85.576804][ T794] Modules linked in: [ 85.578975][ T794] ---[ end trace 0000000000000000 ]--- [ 85.586727][ T5349] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check.